CVE-2025-38689

x86/fpu: Fix NULL dereference in avx512_status()

State
Published
Severity
Not scored
Published
Sep 4, 2025
Updated
May 11, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

x86/fpu: Fix NULL dereference in avx512_status()

Problem ------- With CONFIG_X86_DEBUG_FPU enabled, reading /proc/[kthread]/arch_status causes a warning and a NULL pointer dereference.

This is because the AVX-512 timestamp code uses x86_task_fpu() but doesn't check it for NULL. CONFIG_X86_DEBUG_FPU addles that function for kernel threads (PF_KTHREAD specifically), making it return NULL.

The point of the warning was to ensure that kernel threads only access task->fpu after going through kernel_fpu_begin()/_end(). Note: all kernel tasks exposed in /proc have a valid task->fpu.

Solution -------- One option is to silence the warning and check for NULL from x86_task_fpu(). However, that warning is fairly fresh and seems like a defense against misuse of the FPU state in kernel threads.

Instead, stop outputting AVX-512_elapsed_ms for kernel threads altogether. The data was garbage anyway because avx512_timestamp is only updated for user threads, not kernel threads.

If anyone ever wants to track kernel thread AVX-512 use, they can come back later and do it properly, separate from this bug fix.

[ dhansen: mostly rewrite changelog ]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 22aafe3bcb67472effdea1ccf0df20280192bbaf to before 2ca887e81095b99d890a8878841f36f4920181e6Affected
  • 22aafe3bcb67472effdea1ccf0df20280192bbaf to before 31cd31c9e17ece125aad27259501a2af69ccb020Affected
LinuxLinux
  • 6.16Affected
  • before 6.16Not affected
  • 6.16.2 through 6.16.*Not affected
  • 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.